KYOCERA Document Solutions
PHP2Shell Vulnerabilities
On October 21, 2026, two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were disclosed. Our investigation into the impact on our products confirmed that KYOCERA Net Manager/aQrate and Fiery are affected. The following provides an overview of the vulnerabilities and the recommended countermeasures.
Vulnerability Overview
CVE-2026-109618 - Remote Code Execution Caused by Memory Corruption During an Out-of-Memory Condition
CVE-2026-109619 - Remote Code Execution Caused by Residual Internal State
If these vulnerabilities are exploited, an unauthenticated remote attacker may be able to execute arbitrary code on an affected system. This could affect the confidentiality, integrity, and availability of data and services, including unauthorized access to information, modification of system data, installation of malicious software, and service disruption.
Countermeasures
No permanent workaround is available. The security patch must be applied.
Until the fixed version is applied, prevent direct access from the internet and restrict access to only the required networks, users, and devices. Monitoring the server for suspicious activity may help reduce the risk. We will provide further information as soon as the security patches are ready.
Products Affected by These Vulnerabilities
| Product | Affected Versions |
|---|---|
| KNM/aQrate | 10.2 (Patch 26), 8.2 (Patch 61) and earlier |
| Fiery | Current market version |
Inquiries
Customers except within EU
KYOCERA Document Solutions Inc., Corporate Communication Section
Customers within EU
KYOCERA Document Solutions Europe B.V.
Kyocera Document Solutions Inc. ensures adherence to local data protection regulations. We have detected that your inquiry comes from within the EU. Therefore, due to the EU's General Data Protection Regulation, please note that your request will be forwarded to our regional headquarter: Kyocera Document Solutions Europe.
| * | This article is current, as of the date of publication. |
